From c3c165c1469e743e22014cd5dd2c08e0e166da0c Mon Sep 17 00:00:00 2001
From: naiba <hi@nai.ba>
Date: Wed, 12 Aug 2026 02:27:12 +0000
Subject: [PATCH] fix(terminal): bound websocket input frames

---
 cmd/dashboard/controller/terminal.go                  | 6 ++++++
 cmd/dashboard/controller/terminal_input_limit_test.go | 9 +++++++++
 service/singleton/frontend-templates.yaml             | 2 +-
 3 files changed, 16 insertions(+), 1 deletion(-)
 create mode 100644 cmd/dashboard/controller/terminal_input_limit_test.go

diff --git a/cmd/dashboard/controller/terminal.go b/cmd/dashboard/controller/terminal.go
index 0a78c65b..82546757 100644
--- a/cmd/dashboard/controller/terminal.go
+++ b/cmd/dashboard/controller/terminal.go
@@ -14,6 +14,11 @@ import (
 	"github.com/nezhahq/nezha/service/singleton"
 )
 
+// Allow the frontend's 512 KiB clipboard payload plus xterm's bracketed-paste
+// control bytes, while keeping the complete tagged message below the 1 MiB
+// IO stream relay buffer.
+const terminalWebSocketInputLimit int64 = 512*1024 + 64
+
 // Create web ssh terminal
 // @Summary Create web ssh terminal
 // @Description Create web ssh terminal
@@ -100,6 +105,7 @@ func terminalStream(c *gin.Context) (any, error) {
 	if err != nil {
 		return nil, newWsError("%v", err)
 	}
+	wsConn.SetReadLimit(terminalWebSocketInputLimit)
 	conn := websocketx.NewConn(wsConn)
 	pingTransport := newWebsocketPingTransport(conn, wsConn.Close)
 	stopPing := startWebsocketPingTicker(c.Request.Context(), time.Second*10, pingTransport)
diff --git a/cmd/dashboard/controller/terminal_input_limit_test.go b/cmd/dashboard/controller/terminal_input_limit_test.go
new file mode 100644
index 00000000..7ed3dcc9
--- /dev/null
+++ b/cmd/dashboard/controller/terminal_input_limit_test.go
@@ -0,0 +1,9 @@
+package controller
+
+import "testing"
+
+func TestTerminalWebSocketInputLimitAllowsBoundedPaste(t *testing.T) {
+	if terminalWebSocketInputLimit != 512*1024+64 {
+		t.Fatalf("terminal WebSocket input limit = %d, want 512 KiB plus control-byte allowance", terminalWebSocketInputLimit)
+	}
+}
diff --git a/service/singleton/frontend-templates.yaml b/service/singleton/frontend-templates.yaml
index 19449009..34139a7d 100644
--- a/service/singleton/frontend-templates.yaml
+++ b/service/singleton/frontend-templates.yaml
@@ -2,7 +2,7 @@
   name: "OfficialAdmin"
   repository: "https://github.com/nezhahq/admin-frontend"
   author: "nezhahq"
-  version: "v2.3.2"
+  version: "v2.3.3"
   is_admin: true
   is_official: true
 - path: "user-dist"